Ai Daily Brief

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:59 AM UTC
• Version: 1.0.0

Overview

This skill only builds an AI news brief, but it directs delivery to a fixed Telegram recipient instead of a user-controlled destination.

Review before installing. Use it only if warrior is the intended Telegram recipient, or modify the skill so the destination is user-configured and confirmed before any Telegram message is sent.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:4

Finding

Hard-Coded Telegram Recipient May Cause Unauthorized External Delivery

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 4-18
Vulnerability Type: Hard-coded external recipient
Risk Level: Medium

Relevant Skill Instructions

The relevant instructions, translated into English, are:

text

Concurrently fetch multiple AI news sources, generate a structured daily report, and send it to the user.
...
Send it to warrior on Telegram.

Technical Analysis

The skill initially describes the intended recipient as the user, but its output configuration later directs the report to the hard-coded Telegram identity warrior. It does not establish that warrior is the requesting user, obtain confirmation before transmission, or allow the recipient to be selected through trusted configuration.

If the executing agent has access to a Telegram messaging tool, it may follow the more specific delivery instruction and transmit the generated report to this fixed external identity. This creates a recipient-confusion issue and violates least-privilege principles by directing the agent to use an external communication channel without validating the destination.

No credentials, private local files, or sensitive system information are explicitly requested by the skill. Consequently, the confirmed exposure is limited to the generated report and any contextual information that an implementing agent includes in that report.

Attack Path

1. A user invokes the AI daily-brief skill.
2. The agent retrieves content from the two configured public news websites.
3. The agent generates a structured report from the retrieved content.
4. The agent follows the hard-coded delivery instruction instead of deriving the recipient from the authenticated requesting user.
5. If Telegram messaging capability is available, the report is sent to the Telegram identity warrior.
6. The external recipient receives content without any documented validation that they are authorized to receive it.

I

...[truncated 652 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the hard-coded Telegram identity warrior.
2. Derive the destination from an authenticated, user-controlled configuration value.
3. Require explicit confirmation of the resolved recipient before the first external transmission.
4. Display the destination account and a preview of the information to be sent.
5. Restrict report generation to public news content and prevent automatic inclusion of conversation history, credentials, local files, or system metadata.
6. Enforce an allowlist of approved messaging destinations at the Telegram integration layer.
7. Record recipient resolution and user authorization in an audit log without storing message secrets.
8. Fail safely when no verified recipient is configured rather than falling back to a fixed account.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly states that generated content will be sent to a Telegram account ('warrior') without any visible user consent, destination verification, or warning about external data transfer. Even if the sources are public websites, the compiled report and any included context may be transmitted off-platform to a third party, creating a privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The natural-language instructions and usage documentation are entirely in Chinese, which can amount to forcing a specific language without user opt-in. No alternative language option or explicit locale justification is provided in the file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.